Providing security comprises accessing a database configured to store operational information associated with a process, determining a first behavior using the operational information wherein the first behavior is associated with the process, monitoring the process, and comparing a second behavior with the first behavior wherein the second behavior is attempted by the process.